skills.rest
activepieces
activepiecesOFFICIAL
Explore all skills by this author →
WebsiteGitHub

triage-image-cves

Scan Activepieces Docker images with grype and validate CVE fixes in isolated git worktrees.

24.2k|4.1k|Updated Dec 3, 2022
Search Tags:#docker#container security#NPM#vulnerability scanning#grype#Git worktree#CVE triage
One-click install
npx skills add https://github.com/activepieces/activepieces --skill triage-image-cves
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: triage-image-cves
Source: https://github.com/activepieces/activepieces/tree/main/.agents/skills/triage-image-cves
Command: npx skills add https://github.com/activepieces/activepieces --skill triage-image-cves

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Published Docker images accumulate High and Critical CVEs in both OS packages and npm dependencies, and manually verifying which findings are real, reachable, and safely fixable is slow and error-prone.

Core Features & Use Cases

  • Guided image scanning: Lists the 3 most-recent semver tags of activepieces/activepieces on Docker Hub, lets the user pick one, and runs a reproducible grype scan filtered to High/Critical findings deduped by CVE, package, and version.
  • Per-package validation: Classifies findings as OS (deb) or app (npm), checks runtime reachability, and assigns verdicts such as FIXABLE, FIX_VIA_BASE_BUMP, NOT_REACHABLE, or NO_FIX_YET.
  • Proven fixes, never auto-applied: Validates candidate fixes in a throwaway git worktree through image rebuild, re-scan diffing, tests, container smoke-run, and diff scoping before proposing anything to the user.
  • Use Case: Ask to triage the latest Activepieces image; receive a summary report of reachable High/Critical CVEs, approve specific fixes, and get gate-by-gate evidence that each fix clears the target CVE without introducing new ones.

Quick Start

Scan the latest Activepieces Docker image with grype and triage its High and Critical CVEs.

Frequently Asked Questions about triage-image-cves

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a Docker image for CVEs with grype?▼

Pull the image, then run grype with a pinned platform and JSON output, for example grype activepieces/activepieces:<tag> --platform linux/amd64 -o json. Filter the matches array by severity to isolate High and Critical findings.

How to triage container image vulnerabilities in the Activepieces Docker image?▼

The skill lists the 3 most-recent semver tags from Docker Hub, scans the tag you choose, dedupes findings by CVE, package, and version, and splits them into OS deb packages versus npm dependencies for per-package validation.

Does the skill apply CVE fixes automatically?▼

No, fixes are never auto-applied or committed. Candidate fixes are proven in a throwaway git worktree through rebuild, re-scan, tests, and a container smoke-run, and the user approves, dismisses, or escalates each finding.

What tools are required to run a grype image scan?▼

You need grype on PATH, a running Docker daemon, and network access for the grype vulnerability database. The skill stops and asks you to install grype via a package manager or verified release binary rather than piping a remote installer into a shell.

Why does a CVE in a build tool like g++ not always matter?▼

The shipped image retains build tools from the Dockerfile, so presence does not mean reachability. A CVE in g++ only matters if a runtime path invokes it, which is why each OS finding gets a reachability verdict before any fix is proposed.

What happens when a vulnerability has no upstream fix?▼

Findings with fix state not-fixed or wont-fix receive a NO_FIX_YET verdict and a risk-acceptance writeup instead of a build. The writeup covers reachability, mitigating sandboxing, and options such as accepting the risk, patching locally, or waiting for upstream.

Related Skills

Explore More Software Engineering Skills→
carrotwaxrcarrotwaxr
37

release-workflow

Automate release preparation and Docker image publishing for peek-stash-browser.

Community
Intermediate
home-assistanthome-assistant
90.2k

ha-merge-queue

Identify Home Assistant pull requests ready to merge by verifying CI, reviews, and conflicts.

Official
Advanced
florianbuetowflorianbuetow
12

outdated-deps

Scan project dependencies for CVEs, unpinned versions, and typosquatting risks.

Community
Advanced
riandeoliveirariandeoliveira

implementing-container-image-minimal-base-with-distroless

Replace bloated base images with Google distroless runtime images.

Community
Advanced